{"id":25460,"date":"2026-09-17T09:44:41","date_gmt":"2026-09-17T07:44:41","guid":{"rendered":"https:\/\/compleye.io\/?p=25460"},"modified":"2026-09-22T15:18:22","modified_gmt":"2026-09-22T13:18:22","slug":"ai-and-gdpr-why-data-protection-rules-still-matter","status":"publish","type":"post","link":"https:\/\/compleye.io\/es\/articulos\/ai-and-gdpr-why-data-protection-rules-still-matter\/","title":{"rendered":"AI and GDPR: Why Data Protection Rules Still Matter"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

As artificial intelligence becomes embedded in everyday business operations, one of the most important practical trends is the growing overlap between GDPR enforcement and AI governance. GDPR continues to apply whenever personal data is processed in the development, fine-tuning, deployment or operation of an AI system\u00a0 and the EU AI Act does not change that. <\/span><\/p>

It\u2019s Not About Whether Something Is Labelled \u201cAI\u201d<\/strong> <\/span><\/p>

For organizations using Azure AI Foundry, Anthropic Claude, OpenAI or another hosted model, the key GDPR question is not what the provider calls the product or whether the model is \u201cpre-trained\u201d. GDPR cares less about the label and more about what happens to the personal data. And while the Digital Omnibus has now been formally adopted and signed, the relevant provisions may have different dates of application. Until each applicable amendment takes effect, organizations must continue to apply the GDPR as currently in force. In other words, the label may change; the GDPR homework remains. <\/span><\/p>

When Is an AI Model Anonymous?<\/strong> <\/span><\/p>

The EDPB makes one thing clear: a model trained on personal data is not automatically anonymous. Anonymity must be assessed case by case, including whether personal data can be extracted from the model or revealed through queries. <\/span><\/p>

That is a high bar. \u201cIt contains weights, not a database\u201d is not proof of anonymization. <\/span><\/p>

Suppliers should therefore be able to provide evidence of extraction and memorization testing, adversarial or red-team testing, training-data filtering and deduplication, and controls against data leakage\u00a0 for the specific model and deployment in question. <\/span><\/p>

Anonymization is an evidence-based assessment, not a contractual promise. <\/span><\/p>

<\/span>Lawful Basis for AI Processing<\/strong> <\/span><\/p>

The EDPB confirms that legitimate interest can support AI development or deployment but it is not a shortcut. Controllers still need to show a clear purpose, necessity and fair balance.\u00a0\u201cImproving our AI product\u201d is too vague. A defensible purpose might be detecting fraud or reducing unsafe outputs, backed by evidence that the data is genuinely necessary and proportionate.\u00a0The assessment should also consider individuals\u2019 expectations, the source and sensitivity of the data, scale and duration, objection rights, and safeguards such as filtering, pseudonymization, access controls and retention limits. <\/span><\/p>

\u201cWe have a legitimate interest\u201d is the beginning of the analysis, not the end.<\/strong> <\/span><\/p>

<\/span>Unlawful Training Data Can Create Continuing Risk<\/strong> <\/span><\/p>

If personal data was unlawfully used to train a model, the problem may not end with training. The EDPB indicates that corrective measures could include deleting the unlawfully processed data and, depending on the circumstances, potentially the model itself. Article 17 erasure rights may also apply. <\/span><\/p>

The position is different only where the model no longer processes personal data and has been properly anonymised. And once new personal data enters through prompts, files, logs or outputs, GDPR is back in the room. <\/span><\/p>

AI Service-Provider Roles<\/strong> <\/span><\/p>

For hosted AI, assess the provider\u2019s role activity by activity. A DPA calling a vendor a \u201cprocessor\u201d does not settle the question if the vendor uses the data for its own purposes, such as model development. <\/span><\/p>

Prompts, Outputs and Logs<\/strong> <\/span><\/p>

Personal data does not stop at the prompt. It can appear in uploads, outputs, chat history, logs, telemetry, human reviews, evaluation datasets, embeddings and audit records.\u00a0Map the whole journey\u00a0 from input and inference through storage, monitoring and review to deletion and downstream use. The prompt is only the beginning of the data trail. <\/span><\/p>

Interaction With the AI Act<\/strong> <\/span><\/p>

GDPR and the AI Act are partners, not substitutes: <\/span><\/p>